Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Deploying Deep Security Virtual Appliance(DSVA) in a Guest Introspection and Service Insertion coexisted environment with VMware NSX-T 2.5.0

    • Updated:
    • 23 Jun 2020
    • Product/Version:
    • Deep Security 12.0
    • Platform:

Know how to deploy DSVA in a Guest Introspection (GI) and Service Insertion(SI) coexisted environment with VMware NSX-T 2.5.0. This is specifically for users who use Anti-malware solution but ony have nVDS Logical switch in the environment, or connecting Management interface to nVDS Logical switch instead of using VSS or VDS when deploy DSVA. 



This solution is not supported from DSM Server version 12 FR 2020-06-17. The issue has been solved by VMware on NSX-T 3.0.

Before adopting the latest Deep Security solution, please consider the following upgrade flow:

  • For new deployment users, please upgrade your NSX-T Manager to version 3.0.0 or later.
  • For existed users, please keep your DSM server version below 12 FR 2020-06-17 or upgrade your NSX-T Manager to version 3.0.0 or later.

Please refer to the following deployment prerequisites:

Follow these steps for deployment:

  1. Keep DSM on version 12.0 and remove existing vCenter connector to unregister Partner Service Manager from NSX-T 2.5.0.
    1. Remove the DSVA service deployment plan.
    2. Remove the vCenter connector to force unregister Partner Service Manager from NSX-T 2.5.0 success. Check if the Partner Service has been removed.

  2. Upgrade the DSM server to 12.5 FR-2020-01-27 (12.5.613) or later.
  3. Enable DSVA with Coexist GI+SI function via dsm_c command from DSM server:
    1. Open Command Prompt or PowerShell with local administrator privilege.
    2. Switch working path to DSM default installed folder (ex: C:\Program Files\Trend Micro\Deep Security Manager).
    3. View default value of configuration item: settings.configuration.nsxtAllowNetworkFunctionality

      .\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true
      Return the value: false

    4. Change above configuration item with value ‘true’.

      >.\dsm_c -action changesetting -name settings.configuration.nsxtAllowNetworkFunctionality -value true

  4. Add vCenter connector and NSX-T server from DSM web console. The DSM will register the GI+SI function to NSX-T. Sign on NSX-T web console > System > Service Deployment > CATALOG and it will show both “Endpoint Protection Policy” and “Next Generation Firewall” on Functionality.

  5. Copy the target DSVA packages (ex: dsva-12.0.0-682-small.ovf, and dsva-12.0.0-682-small.cert) from DSM\temp\Appliance-ESX-12.0.0-682.x86_64 to HTTP server.
    Please note the DSVA packages for GI without build info. To deploy coexisting GI+SI DSVA, select packages with build info.

  6. Modify the DSVA download URL from vCenter connector > NSX configuration.
    For example:

    Check if the URL is updated to NSX-T correctly. Click Deploy Service and check the icon from Deployment Specification. Dump the OVF URL for future deployment.

  7. Create Service Deployment plan from NSX-T to deploy DSVA.
    Follow the general Service Deployment procedure same as GI in the Deep Security Help Center.
    There are two required procedures during the deployment:
    1. Select both ens0 and ens2 during the network configuration. The Network could be ESXI standard switch, Distribution Switch (VDS) and Logical Switch (nVDS).

    2. Creating a Service Segment is required. This will bind the Transport Zone used for SI function for coexisting GI+SI DSVA. Please note that the Service Segment is only allowed to be created from standard transport zone. The enhanced Transport zone is not supported.

  8. DSVA connect to nVDS Logical switch and activate success. From vCenter view:

    From NSX-T view:

Configure; Troubleshoot; Deploy
Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.